From 83edafb11fd68b0128e32abe2583d8f60a1fe296 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Mon, 6 Jul 2026 22:29:05 +0800 Subject: [PATCH] fix(ecstore): reject renewing a mis-mounted drive into the wrong set (backlog#799 B19) (#4321) fix(ecstore): reject renewing a misplaced drive into the wrong set (backlog#799 B19) `renew_disk` located the drive's (set, disk) position from its own format via `find_disk_index`, but never checked that the resolved `set_idx` matched this `SetDisks`' own `set_index` before inserting the drive into `self.disks`. A drive whose format places it in another set would be claimed by this set too, so two sets could manage the same drive and degrade together. Skip (with a warning) when `set_idx != self.set_index`. Refs backlog#799 (B19), tracked in rustfs/backlog#863. --- crates/ecstore/src/set_disk/ops/locking.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/crates/ecstore/src/set_disk/ops/locking.rs b/crates/ecstore/src/set_disk/ops/locking.rs index effee49fd..a1baf24d0 100644 --- a/crates/ecstore/src/set_disk/ops/locking.rs +++ b/crates/ecstore/src/set_disk/ops/locking.rs @@ -338,6 +338,18 @@ impl SetDisks { } }; + // The drive's format may place it in a different erasure set than this + // one. Claiming a misplaced drive into `self.disks` would let two sets + // manage the same drive and degrade together, so reject it here + // (backlog#799 B19). + if set_idx != self.set_index { + warn!( + "renew_disk: drive {:?} belongs to set {} but is being renewed on set {}; skipping", + ep, set_idx, self.set_index + ); + return; + } + // Check that the endpoint matches let _ = new_disk.set_disk_id(Some(fm.erasure.this)).await;